Success

Key Component to Risk Management Success

• 

  Culture

  By defining a governance structure and communicating intent and expectations, leaders and managers ensure appropriate leadership involvement, accountability, and training. That last one is critical: ongoing training is required to maintain expertise and deal with new risks.

• 

  Information Sharing

  Security is a team sport. The right stakeholders must be aware of risks, particularly of cross-cutting and shared risks, and be involved in decision making. Information-sharing tools, such as dashboards of relevant metrics, can keep stakeholders aware and involved.

• 

  Priorities 

  To prioritize risks and responses, you need information, such as trends over time, potential impact, time horizon for impact, and when a risk will likely materialize (near term, mid term, or long term). This information will enable comparisons of risks.

• 

  Resilience

  Risk management must also enable continuity of critical missions during and after disruptive or destructive events, including cyber attack.

• 

  Response Speed

  When an organization is exposed to a risk, speedy response can minimize impact. Identifying risks early helps.

• 

  Threat Management

  Cyber security does not always pay enough attention to the threat environment. Implementing basic cyber hygiene practices is a good starting point for cyber risk management.